From fa557773701a0d9750aeeb0284a04dc4d418e755 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Thu, 27 Apr 2017 19:50:01 +0000 Subject: [PATCH] * litiff/tif_fax3.c: avoid crash in Fax3Close() on empty file. Patch by Alan Coopersmith + complement by myself. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2673 * tools/fax2tiff.c: emit appropriate message if the input file is empty. Patch by Alan Coopersmith. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2672 --- ChangeLog | 9 +++++++++ libtiff/tif_fax3.c | 5 +++-- tools/fax2tiff.c | 6 +++++- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index cb25b006..87115215 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,12 @@ +2017-04-27 Even Rouault + + * litiff/tif_fax3.c: avoid crash in Fax3Close() on empty file. + Patch by Alan Coopersmith + complement by myself. + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2673 + * tools/fax2tiff.c: emit appropriate message if the input file is + empty. Patch by Alan Coopersmith. + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2672 + 2017-04-27 Even Rouault * libtiff/tif_ojpeg.c: fix potential memory leak in diff --git a/libtiff/tif_fax3.c b/libtiff/tif_fax3.c index 519b285b..087ceddd 100644 --- a/libtiff/tif_fax3.c +++ b/libtiff/tif_fax3.c @@ -1,4 +1,4 @@ -/* $Id: tif_fax3.c,v 1.79 2017-02-25 17:05:12 erouault Exp $ */ +/* $Id: tif_fax3.c,v 1.80 2017-04-27 19:50:01 erouault Exp $ */ /* * Copyright (c) 1990-1997 Sam Leffler @@ -1129,7 +1129,7 @@ Fax3PostEncode(TIFF* tif) static void Fax3Close(TIFF* tif) { - if ((Fax3State(tif)->mode & FAXMODE_NORTC) == 0) { + if ((Fax3State(tif)->mode & FAXMODE_NORTC) == 0 && tif->tif_rawcp) { Fax3CodecState* sp = EncoderState(tif); unsigned int code = EOL; unsigned int length = 12; @@ -1351,6 +1351,7 @@ InitCCITTFax3(TIFF* tif) "No space for state block"); return (0); } + _TIFFmemset(tif->tif_data, 0, sizeof (Fax3CodecState)); sp = Fax3State(tif); sp->rw_mode = tif->tif_mode; diff --git a/tools/fax2tiff.c b/tools/fax2tiff.c index 01f85540..d43c2dca 100644 --- a/tools/fax2tiff.c +++ b/tools/fax2tiff.c @@ -1,4 +1,4 @@ -/* $Id: fax2tiff.c,v 1.26 2016-11-20 18:04:52 bfriesen Exp $ */ +/* $Id: fax2tiff.c,v 1.27 2017-04-27 19:50:01 erouault Exp $ */ /* * Copyright (c) 1990-1997 Sam Leffler @@ -371,6 +371,10 @@ copyFaxFile(TIFF* tifin, TIFF* tifout) int ok; tifin->tif_rawdatasize = (tmsize_t)TIFFGetFileSize(tifin); + if (tifin->tif_rawdatasize == 0) { + TIFFError(tifin->tif_name, "Empty input file"); + return (0); + } tifin->tif_rawdata = _TIFFmalloc(tifin->tif_rawdatasize); if (tifin->tif_rawdata == NULL) { TIFFError(tifin->tif_name, "Not enough memory");